Invalidate throttling-related dirty bits when changing cross-origin status.

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 4294b0b790cc03d931a4bfdf0e935993b5901ee8..4e428dccac9968b74217bd763e6e0ea8a3215600 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -4652,6 +4652,10 @@ void Document::setDomain(const String& rawDomain,
   }
 
   getSecurityOrigin()->setDomainFromDOM(newDomain);
+
+  if (view())

[pdr., 2017/02/16 04:04:33]

WDYT of changing this to only make the call when needed?
bool wasCrossDomain = m_frame->isCrossOriginSubframe();
getSecurityOrigin()->setDomainFromDOM(newDomain);
if (view() && (wasCrossDomain != m_frame->isCrossOriginSubframe()))
  view()->crossOriginStatusChanged();

I think the root issue is due to SecurityOrigin's m_domainWasSetInDOM which can
change the cross origin bit (see comment in SecurityOrigin::canAccess).

[chrishtr, 2017/02/16 04:25:25]

Ok.
Correct, this is the root issue.

+    view()->crossOriginStatusChanged();
+
   if (m_frame)
     m_frame->script().updateSecurityOrigin(getSecurityOrigin());
 }